(I'm aware log rotation is a common subject, but I tried searching and couldn't find an answer)
For some time now, I've been using the Logfile::Rotate module to rotate logs in a log-monitoring script. So far, I haven't experienced any problems, and it works great because I can use it in Linux and Windows (mainly using Red Hat, and XP/2003). Well, it was brought to my attention by a co-worker that it is possible to lose log data using the "copy and truncate" method that the module uses. He mentioned that traditionally, in Linux, you do "move then send HUP signal to process". It seems like that is the preferred method (from what I see by searching online), but that would make it difficult for the script to port accross multiple OS's like it does now.
I guess my question is - what are your thoughts on this? I guess I thought this module worked perfectly, but this is the point he brings:
## copy current to next incremental
$next = "${currn}.1";
copy ($curr, $next);
## preserve permissions and status
if ( $self->{'Persist'} eq 'yes' ){
my @stat = stat $curr;
chmod( $stat[2], $next ) or carp "error: chmod failed: ($next)";
utime( $stat[8], $stat[9], $next ) or carp "error: failed: ($next)";
chown( $stat[4], $stat[5], $next ) or carp "error: chown failed: ($next)";
}
# now truncate the file
if( $self->{'Flock'} eq 'yes' )
{
truncate $curr,0 or croak "error: could not truncate $curr: $!"; }
else{
local(*IN);
open(IN, "+>$self->{'File'}")
or croak "error: could not truncate $curr: $!";
}
The module does a "flock" on the file, which is an advisory lock on Linux. If the application that is writing to the current log file doesn't flock, then the flock on the rotation module is a no-op.
He mentioned that if the rotation module is task switched by the OS between the 'copy' on the third line and the 'truncate' or 'open' lines, log messages will be lost.
I am not very familiar with the way Linux works, and what I find online are mostly examples (code) of log rotation, and not actual explanations. Any insight on this subject will be greatly appreciated.
Thanks in advance!
edit: did some more testing, and was able to confirm (very minor) log loss with Linux's chatty auditd. I now have it so auditd rotates its own log files, and my script only monitors it. I'll have to come up with log file rotation schemes for all the different files I'm monitoring. Ugh. :-\